What’s Vulnerable › Vulnerabilities

CVE-2026-78337: Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG

• Severity: medium (CVSS 4.8 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-24 · updated 2026-10-12
• Weakness: CWE-434

Description

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an embedded script element.

Affected products

• Roskus Prospero Flow CRM: before 5.15.13 — fixed in 5.15.13

How to fix

Upgrade to a fixed version: Roskus Prospero Flow CRM 5.15.13. Check the vendor advisory for mitigations.

References

• https://github.com/Roskus/prospero-flow-crm/commit/aaa4fc76bf039d5011884b86b8f29ddd50d17b17
• https://secur0.com/en/cna/cve-list/cve-2026-78337-unrestricted-upload-company-logo-svg-xss

Get alerted when CVE-2026-78337 or the next vulnerability affects your stack